CVE-2026-112271

MediumCVSS 5.5

Published: 19/10/2026(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v1 section parser in displayid.c. Attackers can supply a crafted EDID with a data block length exceeding the section, causing is_all_zeroes to read past the buffer and potentially crash.

Risk Assessment

This can lead to denial of service (application crash) when processing untrusted EDID data from monitors, KVMs, capture devices, or files.

Recommendation

Update libdisplay-info to a version later than 0.4.0 or apply the vendor patch. Avoid processing untrusted EDID data.

Other vulnerabilities in libdisplay-info

CVE-2026-112272Medium
Libdisplay-info 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v2 section parser in displayid2.c. Attackers can supply a crafted EDID with oversized data block lengths, causing reads past the buffer and crashing applications.

Original NVD description (English source)

libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v1 section parser in displayid.c that occurs when a data block's declared length exceeds the section. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or EDID file to make is_all_zeroes read past the buffer, causing a possible crash.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS